DCSA Innovation Gateway (HS0021-26-CSO-DCSA): The Complete Guide for Startups
Executive Summary
The DCSA Innovation Gateway is a five-year commercial solicitation from the Defense Counterintelligence and Security Agency (DCSA) that awards Other Transaction Agreements (OTAs) for prototype projects under 10 U.S.C. 4022. It is DCSA's front door for commercial innovators, and it is built specifically so that small businesses and companies with no prior defense contracting history can compete. Companies do not submit against the Gateway itself. They respond to individual Innovation Calls published on SAM.gov under the Gateway, starting with a 6-page Solution Concept Paper rather than a full proposal.
Solicitation number HS0021-26-CSO-DCSA. Open period: June 23, 2026 through June 22, 2031. NAICS code 541512, Computer Systems Design Services.
DCSA Innovation Gateway at a Glance
Agency: Defense Counterintelligence and Security Agency (DCSA), Department of Defense
Solicitation number: HS0021-26-CSO-DCSA
Solicitation type: Commercial Solutions Opening style announcement resulting in prototype OTAs
Award instrument: Other Transaction Agreement (OTA) for prototypes, 10 U.S.C. 4022
Open period: June 23, 2026 to June 22, 2031
First submission: 6-page Solution Concept Paper using the required template (Attachment 1)
Where opportunities are posted: SAM.gov, as Innovation Calls referencing the DCSA Innovation Gateway
Unsolicited proposals: Not accepted and not reviewed
Cost share: Not required for most small businesses and nontraditional defense contractors
Follow-on: Successful prototypes can move to a production contract or transaction without further competition
Technical focus: Digital transformation, data and AI, cyber and industrial security, digital workforce and IT governance
What Is DCSA and Why Does This Solicitation Exist?
DCSA is the Department of Defense agency responsible for personnel vetting and background investigations, industrial security oversight of cleared contractor facilities, counterintelligence, insider threat detection, and security training across the National Industrial Security Program. It touches millions of security clearance records and thousands of cleared facilities, which makes it one of the most data-intensive agencies in the federal government.
The Innovation Gateway exists because DCSA wants commercial technology, not custom-built government software. The agency describes the Gateway as its commercially focused front door for innovators, with the goal of partnering with creative companies to solve its most critical mission challenges. Practically, that means DCSA is willing to skip the traditional FAR-based procurement path and use OTA authority to get prototypes on contract faster, with negotiable terms, negotiable intellectual property rights, and a direct path to production if the prototype works.
For a venture-backed startup or a small commercial software company, this is one of the more accessible defense entry points available, because the first submission is a short concept paper rather than a 50-page proposal with a full cost volume.
What DCSA Is Looking For: The Four Technical Priorities
The Gateway publishes four broad technical priority areas. Individual Innovation Calls narrow these into specific problem statements, but every concept must map back to one or more of these areas.
1. Digital Transformation Enablement
DCSA is seeking prototypes that accelerate agency-wide digital transformation by improving how digital capabilities are designed, delivered, governed, and sustained. The strong preference is for solutions that are reusable across multiple mission and business areas, reduce delivery timelines, improve user experience, and increase operational resilience and security. Enterprise applicability is the theme. A tool that solves one system's problem is far less compelling than a pattern that can be adopted across many systems.
Digital Service Delivery Acceleration: Prototypes that shorten time-to-capability through repeatable delivery patterns such as standardized environments, automated pipelines, release orchestration, and operational readiness practices that work across diverse systems.
Cloud and Infrastructure Modernization as an Enabler: Solutions that simplify adoption and operation of modern hosting through automation, resilience, performance optimization, and cost transparency, with a focus on enterprise applicability rather than single-system optimization.
Modular Architecture and Incremental Modernization: Prototypes aligned with MOSA principles that promote modular, replaceable components, enable stepwise modernization, reduce vendor lock-in, and integrate with existing systems.
Operational Excellence and Continuous Compliance: Efforts that build in observability, configuration management, incident readiness, and continuous compliance so modernized capabilities operate securely and reliably at scale.
2. Data Integration and Advanced Analytics
This priority sits at the center of DCSA's mission, because personnel vetting and industrial security are fundamentally data and risk problems.
Data-Driven Decision Making: Enhancing data understanding, delivery, and management so DCSA can make faster and more accurate risk determinations in personnel and industrial security.
AI and Machine Learning: Implementing AI capabilities that analyze large volumes of data, identify anomalies, and calculate potential risk, while keeping human judgment at the center of trust decisions. That last phrase matters. Concepts that fully automate a trust or clearance decision will not land well. Concepts that surface, rank, and explain risk for a human adjudicator will.
Automated Data Ingestion: Tools that automatically ingest data to improve the speed and quality of background investigations.
3. Cyber and Industrial Security
Securing the Defense Industrial Base: Protecting cleared facilities and IT systems from cyber attacks, foreign insider threats, and vulnerabilities.
Behavioral Threat Analysis Capability (BTAC): Enhancing the ability to detect insider threats through advanced behavioral monitoring.
Zero Trust Architecture: Strengthening cyber posture through modern, secure IT solutions that protect sensitive national security information.
4. Digital Workforce and Governance
Digital Skills Training: Building a skilled digital workforce, including expanded AI experience and cybersecurity awareness.
IT Governance: Establishing enterprise-wide IT, data, and cybersecurity governance to ensure compliance and efficiency.
What Counts as a Prototype Project
Under 10 U.S.C. 4022, a prototype project is defined broadly, which is helpful for software and services companies. It includes a proof of concept, model, or process (including a business process), reverse engineering to address obsolescence, a pilot or novel application of commercial technology for defense purposes, agile development activity, the creation, design, development, or demonstration of operational utility, or any combination of these. Adapting an existing commercial product to a DCSA use case qualifies. You do not need to invent something new from scratch.
Who Is Eligible: OTA Eligibility Rules Explained
Prototype OTAs have statutory eligibility conditions. Under 10 U.S.C. 4022, the awardee must meet at least one of the following three conditions.
(A) Nontraditional participation: At least one nontraditional defense contractor or nonprofit research institution participates to a significant extent in the prototype project.
(B) All small or nontraditional team: All significant participants other than the Federal Government are small businesses (including small businesses in a program under section 9 of the Small Business Act, 15 U.S.C. 638) or nontraditional defense contractors.
(C) One-third cost share: At least one third of total project cost is paid from non-federal sources.
What Is a Nontraditional Defense Contractor?
A nontraditional defense contractor is an entity that is not currently performing, and has not performed for at least one year prior to the solicitation, any DoD contract or subcontract subject to full coverage under the Cost Accounting Standards (CAS). In plain terms, most commercial startups, most venture-backed companies, and most small businesses qualify automatically. If your company has never held a large cost-type DoD contract with full CAS coverage, you are almost certainly nontraditional, and condition (A) or (B) is satisfied without any cost share.
Security Requirements and Foreign Participation
Each Innovation Call specifies whether non-U.S. organizations or individuals may participate and what controls or security regulations apply. Some calls will require a facility clearance or cleared personnel, and some will not. If foreign participation is allowed under a given call, all forms of it must be clearly and fully disclosed in the proposal. For controlled unclassified information (CUI) and classified submissions, that includes disclosing and mitigating any Foreign Ownership, Control, or Influence (FOCI) issues before the submission is transmitted to DCSA. Foreign investors on your cap table are not automatically disqualifying, but they must be disclosed and mitigated, and they should be addressed early rather than discovered during negotiation.
Administrative Requirements Before Award
These are checked before an agreement can be executed, not at concept paper stage, but you should start them now because they take time.
Active SAM.gov registration with a Unique Entity Identifier (UEI)
A CAGE code
Any facility or personnel security clearances required by the specific Innovation Call
Registration and active status in the prescribed government invoicing system, such as the Procurement Integrated Enterprise Environment (PIEE)
Not suspended or debarred, and not prohibited by law or Executive Order from receiving an award
A responsibility determination by the Agreements Officer
Any Organizational Conflicts of Interest (OCI) addressed and mitigated
Funding Allowance, Cost Share, and What to Put in Your ROM
The Innovation Gateway itself does not publish a dollar ceiling or a fixed award size. This is intentional. Award value is established through your Rough Order of Magnitude (ROM) and then negotiated during Phase 3, and individual Innovation Calls may state their own funding parameters or target ranges.
You set the number. The Solution Concept Paper requires a total ROM plus a high-level cost estimate broken into major phases where applicable, showing project phase, estimated duration, and estimated cost range.
Affordability is a scored criterion. DCSA evaluates whether the ROM is within an acceptable range for a prototype effort. A ROM that is too high for the scope described is a real rejection risk, and so is one that is obviously too low to deliver what you promised.
Cost share is generally not required. Cost sharing is not required as a rule. OTs for prototypes require cost share only if the team fails the nontraditional or all-small-business conditions. If the proposing team does not meet those conditions, it must provide at least one third of total cost from its own funds unless a waiver is granted, and waivers are not common and require significant justification.
Voluntary cost share is encouraged where there is commercial upside. DCSA encourages cost sharing where there is a reasonable probability of commercial application related to the effort. Any cost sharing arrangement should be noted in both the Solution Concept Paper and the Full Project Proposal.
The real money is often downstream. Under 10 U.S.C. 4022(f), a successful prototype can transition to a follow-on production contract or transaction without further competition, covering additional units, scaling of the prototype technology, or implementation of the solution.
Scope your ROM to what can credibly be demonstrated as a prototype, phase it, and treat the prototype as the on-ramp to the production OTA rather than the end state.
How the Process Works: Three Phases
Phase 1: Solution Concept Paper
Vendors submit a 6-page Solution Concept Paper in response to a specific Innovation Call. DCSA reviews every concept paper submitted. Important nuance: this initial review may serve as the sole and entire evaluation. After review, the Government may select the most promising vendors and go straight to Phase 3, invite a limited number of vendors into Phase 2, or decide that no submission is suitable and make no selections.
Phase 2: Full Project Proposal (Optional, Invitation Only)
Selected vendors may receive an official invitation to a second evaluation phase. The invitation defines what is required, and it could be a Full Project Proposal, a technical demonstration, an oral presentation, or some combination. This phase is optional and is conducted only if the Government deems it necessary. Plan for the possibility that your 6 pages are the only thing DCSA ever reads.
Phase 3: Negotiation and Award
Vendors selected from either Phase 1 or Phase 2 proceed to collaborative negotiation. The goal is to jointly establish the framework for the prototype project, which includes refining the technical approach, developing a detailed Statement of Work, establishing well-defined milestones and deliverables, establishing a fair and reasonable price, and agreeing on mutual terms and conditions. The Agreements Officer is the only individual with authority to enter into, modify, or execute a binding agreement on behalf of the Government. Selection does not guarantee an award, and the Government may cancel at any point prior to execution.
Timeline and Key Dates
June 23, 2026: DCSA Innovation Gateway published. The Gateway is the umbrella announcement, not a submission deadline.
Ongoing through June 22, 2031: Individual Innovation Calls are published on SAM.gov at various times during the open period, each referencing the Gateway. Each call carries its own problem statement, submission email, deadline, security requirements, and timelines.
Concept paper window: Set by each Innovation Call. These windows are typically short, which is why preparation before a call drops matters more than reaction speed after it.
Within 24 hours of submission: All submissions are acknowledged with an email confirmation.
At 48 hours: If you have not received confirmation, follow up to confirm delivery. DCSA is not responsible for email malfunctions or undeliverable email.
After Phase 1 review: DCSA notifies vendors of results, including a Phase 2 invitation if applicable. No debriefs or feedback are provided on Phase 1 submissions.
Phase 3: Negotiation timing varies with scope and complexity, and award occurs when collaborative and administrative activities are complete and funds are available.
The single most useful planning move is to monitor SAM.gov for Innovation Calls referencing HS0021-26-CSO-DCSA, and to have your company information, OTA eligibility certification, IP posture, and ROM structure drafted in advance so that only the problem-specific content needs to be written when a call opens.
What Goes in the 6-Page Solution Concept Paper
Proposers must use the Solution Concept Paper Template (Attachment 1). Any concept paper that does not use the required template will not be considered for review.
Format Rules You Cannot Change
Page size 8.5 x 11 inches, 1 inch margins, single spacing
Calibri Light, 11 point, black font in the final document
Sections 1 through 6 are limited to 6 pages total
Graphics and illustrations are allowed and are not subject to the format restrictions
Tables are allowed but are subject to the format restrictions
An acronym list or glossary is allowed outside the page count
All grey instruction text in the template must be replaced or deleted before submission
Altering template settings such as font, font size, line spacing, or margins is prohibited
Do not include detailed project plans, formal quotes, or team resumes. The concept paper is not a full proposal, and the focus is meant to be exclusively on the quality of the concept.
Email subject line format: DCSA - Innovation Call [insert #] - Concept Paper [insert Company Name]
Cover Page Contents (Outside the 6-Page Limit)
Gateway number HS0021-26-CSO-DCSA, Innovation Call number and title
A descriptive Solution Concept Paper title. Do not simply copy the Innovation Call title.
Lead organization name, organization type, address, TIN or EIN, UEI, CAGE code, and NAICS code
Subcontractors with name, email, business type, and CAGE code
Technical POC (program manager or principal investigator) and administrative POC with full contact details
Total ROM
OTA eligibility certification under 10 U.S.C. 4022, with initials next to each applicable condition
Proprietary data statement and page markings, if you are restricting data
A table of contents
The Six Required Sections
1. Problem Understanding. Clearly describe your understanding of DCSA's operational problem and the desired end state for the user. This is where most commercial companies lose. Generic mission language reads as unfamiliarity. Name the workflow, the user, and the consequence of the status quo.
2. Proposed Concept and Vision. A one-page narrative describing your big idea, focused on the unique approach, the user experience, and the strategic value delivered. A simple concept diagram is encouraged, and since graphics are exempt from format restrictions, a strong visual buys you page space.
3. High-Level Technical Approach. Briefly outline your technical philosophy and explain why you recommend a particular technology stack, architectural style such as modular or open source, or development methodology such as Agile or DevSecOps for this specific problem. The emphasis is on rationale, not specifications.
4. Intellectual Property and Data Rights. State your data rights and licensing posture across three categories. Background IP: identify pre-existing software or algorithms delivered as proprietary background IP and state the specific license terms and user rights granted to the Government to run, integrate, and maintain it. Foreground IP: list proposed rights and license terms for custom software, code adapters, interfaces, or configurations developed under the effort. Dependencies: disclose third-party software, libraries, or data feeds required to sustain the prototype. This section is scored under Concept Viability, so a vague IP answer is a scored weakness, not a formality.
5. Risk and Opportunity Spotlight. Identify the single biggest technical or programmatic risk that could jeopardize the project, and the single biggest opportunity the Government might be overlooking. Answer both honestly. A paper that claims no meaningful risk reads as inexperienced.
6. Rough Order of Magnitude (ROM). A high-level cost estimate broken into major phases where applicable, with project phase, estimated duration, and estimated cost range, plus any cost share discussion.
How DCSA Evaluates Concept Papers
Concept papers are evaluated on their own merit against the Innovation Call and the criteria below, not against other concept papers submitted to the same call. This is a meaningful advantage. You are not fighting for a fixed number of slots against incumbents. You are clearing a bar.
Concept Viability: Is the idea innovative, technically sound, and compelling? Are the proposed data rights and licensing viable for long-term integration?
Mission Alignment: Does the vendor deeply understand the problem and its operational impact?
Affordability: Is the ROM within an acceptable range for a prototype effort?
Note the phrase in Concept Viability about data rights being viable for long-term integration. DCSA is explicitly screening for lock-in risk. A restrictive license that leaves the Government unable to run, integrate, or maintain the capability can sink an otherwise strong technical concept.
Restrictive Markings, Proprietary Data, and FOIA
Data subject to use restrictions may be included in concept papers but must be clearly marked. You must identify and mark proprietary data intended for Government use only, and identify any technical data or computer software provided with use restrictions. In the absence of that identification, the Government will assume unlimited rights to all technical data and computer software in the concept paper. DCSA intends to treat concept papers as procurement sensitive before award and to disclose contents only to Government employees or designated support contractors for procurement related activities. Classified, sensitive, or critical technology information should not be included in a concept paper. Proposers are cautioned that portions may be subject to release under the Freedom of Information Act, 5 U.S.C. 552.
Non-Government advisors under signed NDAs may participate in evaluation of concept papers, full proposals, and negotiations. Submitting an offer constitutes a grant of authority for their use in all phases.
After Award: How Prototype OTAs Actually Run
Iterative by design. Gateway OTAs are awarded with the intent to use an iterative development approach. The Government and the vendor may mutually agree to modify scope, objectives, and technical requirements during performance.
Scope can expand without recompete. The agreement allows adapting the prototype based on technical discoveries and test results, expanding scope to address new or refined operational requirements, and implementing those changes within the existing OT without a new competitive action.
Multiple paths to success. A prototype is successfully completed upon written determination that it met at least one of the following: fulfilled the key technical goals in the Statement of Work, satisfied the objective success metrics in the OT agreement, or achieved a favorable or unexpected result that provides significant operational utility and justifies transition to production.
Partial completion is allowed. DCSA may declare a specific component successfully completed before the full effort concludes, which lets the Government transition valuable capabilities into production while other parts are still in development.
Follow-on production without recompete. Under 10 U.S.C. 4022(f), a follow-on production contract or transaction may be awarded to prototype participants without further competition, contingent on successful completion to the Government's satisfaction.
Is the DCSA Innovation Gateway Right for Your Startup?
Strong fit signals:
You sell commercial software, data infrastructure, AI and analytics, identity, or cybersecurity capability that can be adapted to a vetting, insider threat, or industrial security workflow
You are a small business or nontraditional defense contractor, so no cost share is triggered
Your architecture is modular and integrates with existing systems rather than requiring a rip and replace
You can offer the Government license terms that support long-term integration and sustainment
You want a path into DoD that does not require winning a full FAR-based competition first
Weaker fit signals:
Hardware-heavy concepts with no clear digital or data integration tie to the four priority areas
Fully automated trust or adjudication decisions that remove the human from the loop
Highly proprietary, closed licensing that creates vendor lock-in
Concepts that solve a single system's problem with no reuse potential across the enterprise
Companies that cannot meet a clearance requirement if a specific Innovation Call imposes one
Frequently Asked Questions
What is the DCSA Innovation Gateway?
The DCSA Innovation Gateway (HS0021-26-CSO-DCSA) is a five-year competitive solicitation from the Defense Counterintelligence and Security Agency that results in the award of prototype projects through Other Transaction Agreements under 10 U.S.C. 4022. It announces DCSA's general areas of interest and the criteria for selecting Solution Concept Papers. Specific requirements are issued separately through Innovation Calls published on SAM.gov.
How do I apply to the DCSA Innovation Gateway?
You do not apply to the Gateway directly. You respond to a specific Innovation Call published on SAM.gov under the Gateway by emailing a 6-page Solution Concept Paper, using the required template, to the address named in that call, with the subject line format DCSA - Innovation Call [number] - Concept Paper [company name].
Can I submit an unsolicited proposal to DCSA under the Gateway?
No. The Government will only accept proposals submitted in response to an Innovation Call. Unsolicited proposals that are not in response to an Innovation Call will not be reviewed.
How much funding can I receive through a DCSA prototype OTA?
The Gateway does not publish a fixed award ceiling. You propose a total Rough Order of Magnitude cost in the concept paper, broken into phases with estimated durations and cost ranges, and the final value is negotiated during Phase 3. Affordability is an evaluation criterion, so the ROM must be defensible for a prototype effort. Individual Innovation Calls may specify their own funding parameters.
Is cost sharing required for a DCSA prototype OTA?
Cost sharing is not required in most cases. Prototype OTs require cost share only when the team does not include a significantly involved nontraditional defense contractor and is not composed entirely of small businesses or nontraditional defense contractors. In that case, at least one third of total cost must come from non-federal funds unless a waiver is granted, and waivers are uncommon and require significant justification. Voluntary cost share is encouraged where commercial application is likely.
Can a startup with no prior DoD contracts qualify?
Yes, and that is the intent. A nontraditional defense contractor is an entity that is not currently performing, and has not performed for at least one year prior to the solicitation, any DoD contract or subcontract subject to full Cost Accounting Standards coverage. Most commercial startups and small businesses meet that definition, which satisfies OTA eligibility without any cost share.
Do I need a security clearance to submit a concept paper?
It depends on the Innovation Call. Each call specifies its own security requirements, including whether facility or personnel clearances are required and whether non-U.S. organizations or individuals may participate. Clearance requirements are verified before award, so read the specific call carefully before investing in a submission.
Can a foreign-owned or foreign-invested company participate?
Each Innovation Call states whether non-U.S. organizations or individuals may participate. Where participation is allowed, all forms of foreign participation must be clearly and fully disclosed in the proposal, and for CUI or classified submissions any Foreign Ownership, Control, or Influence issues must be disclosed and mitigated before the submission is transmitted to DCSA.
How long is the Solution Concept Paper and what format is required?
Sections 1 through 6 are limited to 6 pages, in Calibri Light 11 point, single spaced, with 1 inch margins on 8.5 x 11 inch pages. The required template (Attachment 1) must be used, and a concept paper that does not use the template will not be considered for review. Graphics are exempt from format restrictions, and an acronym list or glossary does not count against the page limit.
What are the evaluation criteria for a Solution Concept Paper?
Three criteria: Concept Viability, meaning whether the idea is innovative, technically sound, and compelling, and whether the proposed data rights and licensing are viable for long-term integration; Mission Alignment, meaning whether the vendor deeply understands the problem and its operational impact; and Affordability, meaning whether the ROM is within an acceptable range for a prototype effort. Papers are judged on their own merit, not against competing submissions.
Will DCSA give me feedback if my concept paper is not selected?
No. DCSA notifies vendors of concept paper evaluation results, but debriefs and feedback on Phase 1 submissions are not provided.
Is Phase 2 guaranteed if my concept paper is strong?
No. The Phase 1 review may serve as the sole and entire evaluation. DCSA may select the most promising vendors and proceed directly to Phase 3 negotiation and award, invite a limited number of vendors to Phase 2, or make no selections at all. Phase 2 is optional and occurs only if the Government deems it necessary.
What happens after a successful prototype project?
Under 10 U.S.C. 4022(f), a follow-on production contract or transaction may be awarded to prototype participants without further competition, contingent on successful completion to the Government's satisfaction. Follow-on production may include procurement of additional units, scaling of the prototype technology, or implementation of the solution.
How is this different from SBIR or STTR?
SBIR and STTR are structured research programs with fixed phase sizes, set topic cycles, and statutory small business eligibility. The Innovation Gateway is an Other Transaction vehicle with negotiated scope, negotiated price, negotiated terms, no fixed award size, and a non-competitive path to production. The trade-off is that terms and IP are negotiated rather than standardized, so preparation on data rights matters more. Many companies pursue both, using SBIR for technology maturation and an OTA for mission integration.
What administrative registrations do I need before award?
An active SAM.gov registration with a Unique Entity Identifier, a CAGE code, registration in the prescribed Government invoicing system such as PIEE, any clearances required by the Innovation Call, no suspension or debarment, a favorable responsibility determination by the Agreements Officer, and mitigation of any organizational conflicts of interest.
How BW&CO Helps Companies Win DCSA Prototype OTAs
BW&CO is a non-dilutive funding advisory firm that has helped clients secure more than $350M in government funding. For the DCSA Innovation Gateway, the work starts well before an Innovation Call is published: positioning your technology against the four technical priority areas, confirming your OTA eligibility path, building a defensible ROM and phasing structure, and settling your background and foreground IP posture so that the data rights section strengthens your score instead of weakening it. When a call drops, the window is short, and companies that prepared in advance are the ones that submit something worth reading.
Innovation Funding Simplified. If you are evaluating the DCSA Innovation Gateway or any other defense prototype pathway, contact BW&CO for a funding fit assessment.
